hxxp://www[.]kekna[.]net/

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
04/06/2024, 17:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://www.kekna.net/

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2804150937-2146708401-419095071-1000\{87E3EA1A-6966-43B2-A43B-B1E20A13DADA}	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
2516	msedge.exe
2516	msedge.exe
5112	msedge.exe
5112	msedge.exe
3312	identity_helper.exe
3312	identity_helper.exe
6088	msedge.exe
6088	msedge.exe
3692	msedge.exe
3692	msedge.exe
3692	msedge.exe
3692	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

pid	Process
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	5644	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	5644	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5112 wrote to memory of 2400	5112	msedge.exe	83
PID 5112 wrote to memory of 2400	5112	msedge.exe	83
PID 5112 wrote to memory of 2968	5112	msedge.exe	84
PID 5112 wrote to memory of 2968	5112	msedge.exe	84
PID 5112 wrote to memory of 2968	5112	msedge.exe	84
PID 5112 wrote to memory of 2968	5112	msedge.exe	84
PID 5112 wrote to memory of 2968	5112	msedge.exe	84
PID 5112 wrote to memory of 2968	5112	msedge.exe	84
PID 5112 wrote to memory of 2968	5112	msedge.exe	84
PID 5112 wrote to memory of 2968	5112	msedge.exe	84
PID 5112 wrote to memory of 2968	5112	msedge.exe	84
PID 5112 wrote to memory of 2968	5112	msedge.exe	84
PID 5112 wrote to memory of 2968	5112	msedge.exe	84
PID 5112 wrote to memory of 2968	5112	msedge.exe	84
PID 5112 wrote to memory of 2968	5112	msedge.exe	84
PID 5112 wrote to memory of 2968	5112	msedge.exe	84
PID 5112 wrote to memory of 2968	5112	msedge.exe	84
PID 5112 wrote to memory of 2968	5112	msedge.exe	84
PID 5112 wrote to memory of 2968	5112	msedge.exe	84
PID 5112 wrote to memory of 2968	5112	msedge.exe	84
PID 5112 wrote to memory of 2968	5112	msedge.exe	84
PID 5112 wrote to memory of 2968	5112	msedge.exe	84
PID 5112 wrote to memory of 2968	5112	msedge.exe	84
PID 5112 wrote to memory of 2968	5112	msedge.exe	84
PID 5112 wrote to memory of 2968	5112	msedge.exe	84
PID 5112 wrote to memory of 2968	5112	msedge.exe	84
PID 5112 wrote to memory of 2968	5112	msedge.exe	84
PID 5112 wrote to memory of 2968	5112	msedge.exe	84
PID 5112 wrote to memory of 2968	5112	msedge.exe	84
PID 5112 wrote to memory of 2968	5112	msedge.exe	84
PID 5112 wrote to memory of 2968	5112	msedge.exe	84
PID 5112 wrote to memory of 2968	5112	msedge.exe	84
PID 5112 wrote to memory of 2968	5112	msedge.exe	84
PID 5112 wrote to memory of 2968	5112	msedge.exe	84
PID 5112 wrote to memory of 2968	5112	msedge.exe	84
PID 5112 wrote to memory of 2968	5112	msedge.exe	84
PID 5112 wrote to memory of 2968	5112	msedge.exe	84
PID 5112 wrote to memory of 2968	5112	msedge.exe	84
PID 5112 wrote to memory of 2968	5112	msedge.exe	84
PID 5112 wrote to memory of 2968	5112	msedge.exe	84
PID 5112 wrote to memory of 2968	5112	msedge.exe	84
PID 5112 wrote to memory of 2968	5112	msedge.exe	84
PID 5112 wrote to memory of 2516	5112	msedge.exe	85
PID 5112 wrote to memory of 2516	5112	msedge.exe	85
PID 5112 wrote to memory of 4076	5112	msedge.exe	86
PID 5112 wrote to memory of 4076	5112	msedge.exe	86
PID 5112 wrote to memory of 4076	5112	msedge.exe	86
PID 5112 wrote to memory of 4076	5112	msedge.exe	86
PID 5112 wrote to memory of 4076	5112	msedge.exe	86
PID 5112 wrote to memory of 4076	5112	msedge.exe	86
PID 5112 wrote to memory of 4076	5112	msedge.exe	86
PID 5112 wrote to memory of 4076	5112	msedge.exe	86
PID 5112 wrote to memory of 4076	5112	msedge.exe	86
PID 5112 wrote to memory of 4076	5112	msedge.exe	86
PID 5112 wrote to memory of 4076	5112	msedge.exe	86
PID 5112 wrote to memory of 4076	5112	msedge.exe	86
PID 5112 wrote to memory of 4076	5112	msedge.exe	86
PID 5112 wrote to memory of 4076	5112	msedge.exe	86
PID 5112 wrote to memory of 4076	5112	msedge.exe	86
PID 5112 wrote to memory of 4076	5112	msedge.exe	86
PID 5112 wrote to memory of 4076	5112	msedge.exe	86
PID 5112 wrote to memory of 4076	5112	msedge.exe	86
PID 5112 wrote to memory of 4076	5112	msedge.exe	86
PID 5112 wrote to memory of 4076	5112	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.kekna.net/
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xfc,0xe0,0x7ffcce9946f8,0x7ffcce994708,0x7ffcce994718
  2⤵
  PID:2400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,10930629183309698,4911666727278752817,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2140 /prefetch:2
  2⤵
  PID:2968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2124,10930629183309698,4911666727278752817,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2352 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2124,10930629183309698,4911666727278752817,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2928 /prefetch:8
  2⤵
  PID:4076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,10930629183309698,4911666727278752817,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:3428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,10930629183309698,4911666727278752817,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:3628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,10930629183309698,4911666727278752817,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4748 /prefetch:1
  2⤵
  PID:2040
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,10930629183309698,4911666727278752817,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4888 /prefetch:8
  2⤵
  PID:2860
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,10930629183309698,4911666727278752817,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4888 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,10930629183309698,4911666727278752817,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5464 /prefetch:1
  2⤵
  PID:4060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,10930629183309698,4911666727278752817,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5480 /prefetch:1
  2⤵
  PID:4924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,10930629183309698,4911666727278752817,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4860 /prefetch:1
  2⤵
  PID:5144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,10930629183309698,4911666727278752817,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4816 /prefetch:1
  2⤵
  PID:5152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,10930629183309698,4911666727278752817,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5696 /prefetch:1
  2⤵
  PID:5452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,10930629183309698,4911666727278752817,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:1
  2⤵
  PID:5820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2124,10930629183309698,4911666727278752817,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5636 /prefetch:8
  2⤵
  PID:6080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2124,10930629183309698,4911666727278752817,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5604 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:6088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,10930629183309698,4911666727278752817,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=188 /prefetch:1
  2⤵
  PID:4472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,10930629183309698,4911666727278752817,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6064 /prefetch:1
  2⤵
  PID:4584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,10930629183309698,4911666727278752817,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6096 /prefetch:1
  2⤵
  PID:3140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,10930629183309698,4911666727278752817,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4804 /prefetch:1
  2⤵
  PID:5512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,10930629183309698,4911666727278752817,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1868 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3692

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:444

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3692

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x2f4 0x2ec
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5644

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4b4f91fa1b362ba5341ecb2836438dea

SHA1
9561f5aabed742404d455da735259a2c6781fa07

SHA256
d824b742eace197ddc8b6ed5d918f390fde4b0fbf0e371b8e1f2ed40a3b6455c

SHA512
fef22217dcdd8000bc193e25129699d4b8f7a103ca4fe1613baf73ccf67090d9fbae27eb93e4bb8747455853a0a4326f2d0c38df41c8d42351cdcd4132418dac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
eaa3db555ab5bc0cb364826204aad3f0

SHA1
a4cdfaac8de49e6e6e88b335cfeaa7c9e3c563ca

SHA256
ef7baeb1b2ab05ff3c5fbb76c2759db49294654548706c7c8e87f0cde855b86b

SHA512
e13981da51b52c15261ecabb98af32f9b920651b46b10ce0cc823c5878b22eb1420258c80deef204070d1e0bdd3a64d875ac2522e3713a3cf11657aa55aeccd4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000014

Filesize
238KB

MD5
ddd22f2c03e7b9f0058d5876e8191da1

SHA1
c760673b65285fec3201a12348fae3dc3f4f3a6a

SHA256
f22eb11e4f296b519a48b1ed205859f344c25c7f295a2356cdfd88eb5b038d4c

SHA512
e4bafc5d9df70c3c16efb8fce4365a95d9e6c85d705f0940bb959791f2898d78d9f843c288b9813abdd4936546b55e3499d6b8fa10039668fe94eaa045b17a1a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
bff7b3fd562bfd015b85923160eca399

SHA1
105dac99558f040d1a4d675b9df4842bc7846c2c

SHA256
f22ffc8e8d64bf240051ce8a14bd6a9013a34df7c05df8122eeb3418061ea694

SHA512
392cff19f6fa3132750bc92540d714cba424b053ca616160a6a8ea7a66c71b5423957bb938b2f1be856433dcf8e2bd1c7a0b92f7b46e7862cba3ef6b2c147ec7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
9baa2c1b5fd58a1de766d9f39a9a9996

SHA1
21cd3365c03910fdfa315d4e1fd5a4e8b94c7518

SHA256
9d1602348fb3b96e34ffa1a9810c00314945ecd769085219dc7b0ab6c371f72c

SHA512
dea5c8b8f6c0706963bebaf809d9015edb2a4cb850d06f96c25b5704021b3b1830f244a2098892af31326d03f4b5576172a66b9fea1020a5350bec465f076fb6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
2f30530eb61847f5e572f4e315285b59

SHA1
54a81da92b84505804c4774d1cfd881f12c11932

SHA256
1213eb3fe6edc945fd6858695187b09d1b17decdb7dd87f15ef6fac1a60582ff

SHA512
e8556e04e3f65295ad47d093956e214e5e70577d62ba101dfd3b970c2160c2a23c4de2b4608f19715d95388f5e30ed415661290ac815623b3912e61c38853486

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
a0cd2b06123c0810cef31bcc289536ff

SHA1
d705df32deb0073488d42ecc5d609d52228a7a84

SHA256
8eebc863315b6eacf642f8e1d3f5702a77890d3aa66292b881dcf76ba161f348

SHA512
1b58f859f73ff477db9ce334b2a90aa2e05e3e4bea6b0feb997c7f1a00aad2d93cbe71ae5768d012825ff9a5261b3d13021e15f80f1f7bc36054e25a736dde2b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
8440dd551e416c158912b8fe9420cf91

SHA1
d972c88d9d9bb5aa8c7aa088abb4c5c01e54ac0e

SHA256
8c2ec23a6bbd007a6680911a68de7a2e981bffd4b6ca2b6ac9cbd4cbcb76d71e

SHA512
f6d9a88570cba00ca2d0f5e112259d3db69d77e8fdabc598609dba4d73843963b1618ccc401c41a606e9093715bfa9c01ebc3b0050889ee79f9b260e134361c5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
36af467f303510c834d678fa130d855b

SHA1
64c6b9352d90c7c10faaa87c59262bd0b61445af

SHA256
9dd6c3ce6621ea7c8bdff264c2e85a3379018b2ba84ef440d7da4d8d55d31bca

SHA512
2607d974bf8ff5657a1204cd8aa2eb11afb8f0a6bc390fec77233c092f11ea8551e9a424ef08286d096f82684ba6e72090908b5bf3f1e11c040c77af5552d417

Download Submit